最新のMS-100試験問題集でMicrosoft試験にはトレーニングを提供しています
合格できるMicrosoft Microsoft 365 Identity and ServicesのPDF問題集は最近更新された304問あります
Microsoft MS-100 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
| トピック 6 |
|
質問 47
From the Microsoft Azure Active Directory (Azure AD) Identity Protection dashboard, you view the risk events shown in the exhibit. (Click the Exhibit tab.)
You need to reduce the likelihood that the sign-ins are identified as risky.
What should you do?
- A. From the Security & Compliance admin center, create a classification label.
- B. From the Conditional access blade in the Azure Active Directory admin center, create named locations.
- C. From the Azure Active Directory admin center, configure the trusted IPs for multi-factor authentication.
- D. From the Security & Compliance admin center, add the users to the Security Readers role group.
正解: B
解説:
References:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
質問 48
You need to meet the technical requirements for the user licenses.
Which two properties should you configure for each user? To answer, select the appropriate properties in the answer area.
NOTE: Each correct selection is worth one point.
正解:
解説:
質問 49
You need to ensure that all the sales department users can authenticate successfully during Project1 and Project2.
Which authentication strategy should you implement for the pilot projects?
- A. pass-through authentication
- B. pass-through authentication and seamless SSO
- C. password hash synchronization
- D. password hash synchronization and seamless SSO
正解: D
解説:
* Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft
365.
* Project2: After the successful completion of Project1, Microsoft Teams & Skype for Business will be enabled in Microsoft 365 for the sales department users.
* After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
* Fabrikam does NOT plan to implement identity federation.
* After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
You need to enable password hash synchronization to enable the users to continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
You need to enable SSO to enable all users to be signed in to on-premises and cloud-based applications automatically.
Reference:
https://docs.microsoft.com/en-us/azure/security/azure-ad-choose-authn
Plan Office 365 Workloads and Applications
Question Set 1
質問 50
Your company has a Microsoft 365 subscription that contains the users shown in the following table.
You need to identify which users can perform the following administrative tasks:
* Modify the password protection policy.
* Create guest user accounts.
Which users should you identify for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
Only a Global Admin can modify the password protection policy.
A Global Admin or a user with the Guest Inviter role can create guest accounts.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-op
質問 51
Your network contains two Active Directory forests. Each forest contains two domains. All client computers run Windows 10 and are domain-joined.
You plan to configure Hybrid Azure AD join for the computers.
You create Microsoft Azure Active Directory (Azure AD) tenant.
You need to ensure that the computers can discover the Azure AD tenant.
What should you create?
- A. a new service connection point (SCP) for each domain
- B. a new computer account for each computer
- C. a new trust relationship for each forest
- D. a new service connection point (SCP) for each forest
正解: D
解説:
Your devices use a service connection point (SCP) object during the registration to discover Azure AD tenant information. In your on-premises Active Directory instance, the SCP object for the hybrid Azure AD joined devices must exist in the configuration naming context partition of the computer's forest. There is only one configuration naming context per forest. In a multi-forest Active Directory configuration, the service connection point must exist in all forests that contain domain-joined computers.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-manual
Topic 1, Fabrikam, Inc
Existing Environment
Active Directory Environment
The network contains an Active Directory forest named fabrikam.com. The forest contains all the identities used for user and computer authentication.
Each department is represented by a top-level organizational unit (OU) that contains several child OUs for user accounts and computer accounts.
All users authenticate to on-premises applications by signing in to their device by using a UPN format of [email protected].
Fabrikam does NOT plan to implement identity federation.
Network Infrastructure
Each office has a high-speed connection to the Internet.
Each office contains two domain controllers. All domain controllers are configured as a DNS server.
The public zone for fabrikam.com is managed by an external DNS server.
All users connect to an on-premises Microsoft Exchange Server 2016 organization. The users access their email by using Outlook Anywhere, Outlook on the web, or the Microsoft Outlook app for iOS. All the Exchange servers have the latest cumulative updates installed.
All shared company documents are stored on a Microsoft SharePoint Server farm.
Requirements
Planned Changes
Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.
Fabrikam plans to implement two pilot projects:
Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.
Project2: After the successful completion of Project1, Microsoft Teams & Skype for Business will be enabled in Microsoft 365 for the sales department users.
Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.
Technical Requirements
Fabrikam identifies the following technical requirements:
All users must be able to exchange email messages successfully during Project1 by using their current email address.
Users must be able to authenticate to cloud services if Active Directory becomes unavailable.
A user named User1 must be able to view all DLP reports from the Microsoft 365 admin center.
Microsoft Office 365 ProPlus applications must be installed from a network share only.
Disruptions to email address must be minimized.
Application Requirements
Fabrikam identifies the following application requirements:
An on-premises web application named App1 must allow users to complete their expense reports online.
The installation of feature updates for Office 365 ProPlus must be minimized.
Security Requirements
Fabrikam identifies the following security requirements:
After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.
The memberships of UserLicenses must be validated monthly. Unused user accounts must be removed from the group automatically.
After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.
The principle of least privilege must be used.
質問 52
You have a Microsoft 365 subscription.
You recently configured a Microsoft SharePoint Online tenant in the subscription.
You plan to create an alert policy.
You need to ensure that an alert is generated only when malware is detected in more than five documents stored in SharePoint Online during a period of 10 minutes.
What should you do first?
- A. Enable Microsoft Office 365 Cloud App Security.
- B. Enable Microsoft Office 365 Analytics.
- C. Deploy Windows Defender Advanced Threat Protection (Windows Defender ATP).
正解: C
解説:
Explanation:
質問 53
Your company has a Microsoft Office 365 subscription that contains the groups shown in the following table.
You have the licenses shown in the following table.
Another administrator removes User1 from Group1 and adds Group2 to Group1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
User1, User2 and User3 have each been assigned a SharePoint license directly. Therefore, they are all licensed for SharePoint Online.
Changing the group memberships will only affect whether or not they are licensed for Exchange Online because the Exchange Online licenses are assigned to Group1.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-po
質問 54
You have a new Microsoft 365 subscription.
A user named User1 has a mailbox in Microsoft Exchange Online.
You need to log any changes to the mailbox folder permissions of User1.
Which command should you run? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
To enable auditing for a single mailbox (in this example, belonging to Holly Sharp), use this PowerShell command: Set-Mailbox username -AuditEnabled $true References:
https://support.microsoft.com/en-us/help/4026501/office-auditing-in-office-365-for-admins
https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/set-mailbox?view=exchange-ps
Topic 1, Contoso, Ltd
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answer and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.
The offices have the users and devices shown in the following table.
Contoso recently purchased a Microsoft 365 E5 subscription.
Existing Environment
The network contains an Active directory forest named contoso.com and a Microsoft Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.
You recently configured the forest to sync to the Azure AD tenant.
You add and then verify adatum.com as an additional domain name.
All servers run Windows Server 2016.
All desktop computers and laptops run Windows 10 Enterprise and are joined to contoso.com.
All the mobile devices in the Montreal and Seattle offices run Android. All the mobile devices in the New York office run iOS.
Contoso has the users shown in the following table.
Contoso has the groups shown in the following table.
Microsoft Office 365 licenses are assigned only to Group2.
The network also contains external users from a vendor company who have Microsoft accounts that use a suffix of @outlook.com.
Requirements
Planned Changes
Contoso plans to provide email addresses for all the users in the following domains:
* East.adatum.com
* Contoso.adatum.com
* Humongousinsurance.com
Technical Requirements
Contoso identifies the following technical requirements:
* All new users must be assigned Office 365 licenses automatically.
* The principle of least privilege must be used whenever possible.
Security Requirements
Contoso identifies the following security requirements:
* Vendors must be able to authenticate by using their Microsoft account when accessing Contoso resources.
* User2 must be able to view reports and schedule the email delivery of security and compliance reports.
* The members of Group1 must be required to answer a security question before changing their password.
* User3 must be able to manage Office 365 connectors.
* User4 must be able to reset User3 password.
質問 55
You have a Microsoft 365 subscription.
You create an alert policy as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information in the graphic.
NOTE: Each correct selection is worth one point.
正解:
解説:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies
質問 56
You need to meet the technical requirements for the user licenses.
Which two properties should you configure for each user? To answer, select the appropriate properties in the answer area.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
質問 57
In Microsoft 365, you configure a data loss prevention (DLP) policy named Policy1. Policy1 detects the sharing of United States (US) bank account numbers in email messages and attachments.
Policy1 is configured as shown in the exhibit. (Click the Exhibit tab.)
You need to ensure that internal users can email documents that contain US bank account numbers to external users who have an email suffix of contoso.com.
What should you configure?
- A. an exception
- B. an action
- C. a group
- D. a condition
正解: B
解説:
Explanation
References:
https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies#how-dlp-policiesw
質問 58
Your network contains an on-premises Active Directory domain that is synced to Microsoft Azure Active Directory (Azure AD) as shown in the following exhibit.
An on-premises Active Directory user account named Allan Yoo is synchronized to Azure AD. You view Allan's account from Microsoft 365 and notice that his username is set to [email protected].
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
質問 59
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.
Multi-factor authentication (MFA) is configured to use 131.107.50/24 for trusted IPs.
The tenant contains the named locations shown in the following table.
You create a conditional access policy that has the following configurations:
Users and groups assignment: All users
Cloud apps assignment: App1
Conditions: Include all trusted locations
Grant access: require multi-factor authentication
For each of the following statements, select Yes if the statement is true. otherwise, select No.
NOTE: Each correct selection is worth one point.
正解:
解説:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
質問 60
You have three devices enrolled in Microsoft Intune as shown in the following table.
The device compliance policies in Intune are configured as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正解:
解説:
Reference:
https://blogs.technet.microsoft.com/cbernier/2017/07/11/windows-10-intune-windows-bitlocker-management-yes/
質問 61
You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.
A user named User1 has files on a Windows 10 device as shown in the following table.
In Azure Information Protection, you create a label named Label1 that is configured to apply automatically.
Label1 is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
The phrase to match is "im" and it is case sensitive. The phrase must also appear at least twice.
Box 1: No
File1.docx contain the word "import" once only
Box 2: Yes
File2.docx contains two occurrences of the word "import" as well as the word "imported" Box 3: No File3.docx contains "IM" but his is not the correct letter case.
References:
https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-classification
質問 62
You have a Microsoft 365 Enterprise E5 subscription.
You need to enforce multi-factor authentication on all cloud-based applications for the users in the finance department.
What should you do?
- A. Create an activity policy.
- B. Create a conditional access policy.
- C. Create a session policy.
- D. Create a new app registration.
正解: B
質問 63
Your company has a Microsoft Azure Active Directory (Azure AD) directory tenant named contoso.onmicrosoft.com.
All users have client computers that run Windows 10 Pro and are joined to Azure AD.
The company purchases a Microsoft 365 E3 subscription.
You need to upgrade all the computers to Windows 10 Enterprise. The solution must minimize administrative effort.
You assign licenses from the Microsoft 365 admin center.
What should you do next?
- A. Add a custom domain name to the subscription.
- B. Create a provisioning package, and then deploy the package to all the computers.
- C. Instruct all the users to log off of their computer, and then to log in again.
- D. Deploy Windows 10 Enterprise by using Windows Autopilot.
正解: D
解説:
Section: [none]
Explanation:
With Windows Autopilot the user can set up pre-configure devices without the need consult their IT administrator.
Reference:
https://docs.microsoft.com/en-us/windows/deployment/windows-10-deployment-scenarios
https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot
質問 64
You have a Microsoft 365 subscription that contains the users shown in the following table.
You plan to use Exchange Online to manage email for a DNS domain.
An administrator adds the DNS domain to the subscription.
The DNS domain has a status of incomplete setup.
You need to identify which user can complete the setup of the DNS domain. The solution must use the principle of least privilege.
Which user should you identify?
- A. User1
- B. User2
- C. User3
- D. User4
正解: A
解説:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/admin/setup/add-domain?view=o365-worldwide
質問 65
Your network contains an on-premises Active Directory domain. The domain contains a server named Server1. Server1 has a share named Share1 that contains the files shown in the following table.
You have a hybrid deployment of Microsoft 365.
You create a Microsoft SharePoint site collection named Col lection1.
You plan to migrate Share1 to a document library in Collection1
You configure the SharePoint Migration Tool as shown in the exhibit. (Click the Exhibit tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正解:
解説:
References:
https://docs.microsoft.com/en-us/sharepointmigration/spmt-settings
質問 66
You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.
You add an app named App1 to the enterprise applications in contoso.com.
You need to configure self-service for App1.
What should you do first?
- A. Configure the provisioning mode for App1.
- B. Configure an SSO method for App1.
- C. Assign App1 to users and groups.
- D. Add an owner to App1.
正解: A
解説:
Explanation
The provisioning mode (manual or automatic) needs to be configured for an app before you can enable self-service application access.
References:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-self-service-access
質問 67
Your company has an on-premises Microsoft Exchange Server 2016 organization. The organization is in the company's main office in Melbourne. The main office has a low-bandwidth connection to the Internet.
The organization contains 250 mailboxes.
You purchase a Microsoft 365 subscription and plan to migrate to Exchange Online next month.
In 12 months, you plan to increase the bandwidth available for the Internet connection.
You need to recommend the best migration strategy for the organization. The solution must minimize administrative effort.
What is the best recommendation to achieve the goal? More than one answer choice may achieve the goal.
Select the BEST answer.
- A. network upload
- B. hybrid migration
- C. cutover migration
- D. staged migration
正解: B
解説:
With a hybrid migration, you can migrate the mailboxes in small batches over a period of time which will help to avoid saturating the bandwidth. With the migration wizard, you can configure a migration batch to start outside office hours which would minimize bandwidth usage during office hours.
With a hybrid migration, you do not need to reconfigure Outlook to connect to the migrated mailbox. Outlook will automatically detect the new mailbox location. This reduces administrative effort.
Incorrect Answers:
A: 'Network upload' is not a defined migration strategy.
B: With a cutover migration, all mailboxes are migrated in one go. This is not suitable for a low bandwidth Internet connection. You would also need to manually reconfigure Outlook for each user which does not meet the requirement of minimizing administrative effort.
D: With a staged migration, mailboxes are migrated in batches. However, Microsoft recommends using a staged migration when you have more than 2000 mailboxes. You would also need to manually reconfigure Outlook for each user which does not meet the requirement of minimizing administrative effort.
Reference:
https://docs.microsoft.com/en-us/exchange/mailbox-migration/mailbox-migration
質問 68
You have a Microsoft Azure Active Directory (Azure AD) tenant.
Your company implements Windows Information Protection (WIP).
You need to modify which users and applications are affected by WIP.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解:
解説:
Explanation
Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune manages only the apps on a user's personal device.
The MAM User scope determines which users are affected by WIP. App protection policies are used to configure which applications are affected by WIP.
Reference:
https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/crea
質問 69
You have a Microsoft 365 subscription.
You plan to enable Microsoft Azure Information Protection.
You need to ensure that only the members of a group named PilotUsers can protect content.
What should you do?
- A. Configure the protection activation status for Azure Information Protection.
- B. Create an Azure Information Protection policy.
- C. Run the Set-AadrmOnboardingControlPolicy cmdlet.
- D. Run the Add-AadrmRoleBaseAdministrator cmdlet.
正解: C
解説:
If you don't want all users to be able to protect documents and emails immediately by using Azure Rights Management, you can configure user onboarding controls by using the Set-AadrmOnboardingControlPolicy References:
https://docs.microsoft.com/en-us/azure/information-protection/activate-service
質問 70
......
更新されたテストエンジン練習MS-100問題集と練習試験で使おう：https://www.goshiken.com/Microsoft/MS-100-mondaishu.html
問題集お試しセットMS-100テストエンジン問題集トレーニングには304問あります：https://drive.google.com/open?id=1EGy2-6jbgmSRGK6y89oTXMEXELey_s86